Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...

TECHNIQUES
SYSCALL HOOKS
static struct sysent * find_sysent () {
struct sysent *table;
int *nsysent = (int *)find_kernel_symbol("_nsysent");
table = (struct sysent *)(((uint64_t)nsysent) -
((uint64_t)sizeof(struct sysent) * (uint64_t)*nsysent));
}
if (table[SYS_syscall].sy_narg == 0 &&
table[SYS_exit].sy_narg == 1 &&
table[SYS_fork].sy_narg == 0 &&
table[SYS_read].sy_narg == 3 &&
table[SYS_wait4].sy_narg == 4 &&
table[SYS_ptrace].sy_narg == 4)
{
return table;
} else {
return NULL;
}
Defiling Mac OS X - Ruxcon
November, 2011